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In conventional quantum key distribution (QKD) protocols, security is guaranteed by es¬ 
timating the amount of leaked information through monitoring signal disturbance, which, 
in practice, is generally caused by environmental noise and device imperfections rather 
than eavesdropping. Such estimation therefore tends to overrate the amount of leaked in¬ 
formation in practice, leads to a fundamental threshold of the bit error rate. The threshold 
becomes a bottleneck of the development of practical QKD systems. In classical com¬ 
munication, according to Shannon’s communication theory, information can transform 
through a noisy channel even if the background noise is very strong compare to the signal 
and hence the threshold of the bit error rate tends to 50%^ One might wonder whether a 
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QKD scheme can also tolerate error rate as high as 50 %. The question is answered affir¬ 
matively with the recent work of round-rohin differential phase-shift (RRDPS) protocoP’^, 
which breaks through the fundamental threshold of the hit error rate and indicates an¬ 
other potential direction in the field of quantum cryptography. The key challenge to re¬ 
alize the RRDPS scheme lies on the measurement device, which requires a variahle-delay 
interferometer. The delay needs to he chosen from a set of predetermined values ran¬ 
domly. Such measurement can he realized hy switching between many interferometers 
with different delays at a high speed in accordance with the system repetition rate. The 
more delay values can be chosen from, the higher error rate can be tolerated. By design¬ 
ing an optical system with multiple switches and employing an active phase stabilization 
technology, we successfully construct a variable-delay interferometer with 128 actively 
selectable delays. With this measurement, we experimentally demonstrate the RRDPS 
QKD protocol and obtain a final key rate of 15.54 bps via a total loss of 18 dB and 8.9% 
error rate. Our experiment demonstrates that the RRDPS QKD protocol is practical with 
current technology. 

In a QKD protocol, the sender, Aliee, sends a quantum signal through an untrusted quan¬ 
tum channel. The reeeiver. Bob, measures the arrived quantum signal and obtains the raw key. 
Because of the device imperfeetions, environmental interference and possibly eavesdropping, 
the raw keys of Aliee and Bob maybe not be identieal or private. In the security analysis, the 
disturbanee of the signal is quantified by the bit flip error rate, ebu, and the leaked information 
is quantified by the phase error rate, Cph- To ensure the final keys are identieal and seeure, a 
proper postproeessing should be performed. After performing the error eorreetion, whieh re¬ 
moves the disturbances, and one should apply privacy amplification, which removes the leaked 
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information. The final key generation rate per raw key bit is given by^, 


R= 1 - H{ebit) - H{eph). (1) 

When the error rates, ebit and Cph, exeeeds some thresholds, the key rate beeomes zero or nega¬ 
tive and henee no seeure keys can be generated. 

In conventional QKD protocols, security is guaranteed by the Heisenberg uncertainty 
principle which guarantees that any attempts of eavesdropping the quantum channel would in¬ 
evitably cause quantum signal disturbances. Therefore, the leaked information obtained by an 
eavesdropper. Eve, can be upper-bounded by the disturbance of the signal. In the Bennett- 
Brassard-1984 (BB84) protocol, due to its symmetry, the phase error rate is estimated by the 
bit error rate Cph = eut and hence the final key rate, in Eq. (1), is given by i? = 1 — 2H{ebit)- 
When eut > 11%, the final key rate approaches to 0. Hence, the bit error rate threshold for 
the BB84 protocol is 11% using the above postprocessing. Note that with other postprocess¬ 
ing techniques®, a higher bit error rate threshold can be obtained. Nevertheless, there exists 
a fundamental limitation on the error rate threshold^. It is widely believed that secure QKD 
cannot be achieved when the background noise is too strong compare to the signal. In practice, 
the strength of background noise can be considered as a constant, whereas the strength of the 
signal exponentially decreases with an increasing transmission distance. Hence, the error rate 
threshold puts a fundamental limit on the secure transmission distance. Erom a realistic point 
of view, most of disturbances are caused by the environment noises and device imperfections 
instead of eavesdropping. Thus the leaked information is often overestimated, which is the root 
for the limit on the error rate threshold. 

In classical communication, according to Shannon’s communication theory, such error 
rate limit does not exist as long as eut % 50% ‘. One might wonder whether a QKD scheme 
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can also tolerate error rate as high as 50%. Reeently, a new QKD protoeoP called RRDPS 
was proposed, which is essentially evolved from the differential phase-shift (DPS) protocol*’^. 
Surprisingly, with the new protocol, secure key can be generated even if the bit flip error rate 
close to 50%. 

The sehematic diagram of the RRDPS QKD seheme is shown in Fig. 1 . Alice prepares 
a pulse train containing L pulses, eneodes the (random) key information into the phase of eaeh 
pulse, 0 or vr, and sends it to Bob, who splits the L-pulse train into two with a beam splitter. 
Bob randomly shifts (backward or forward) one of the split pulse trains by d pulses where 
1 < d < L — 1, and interferes them. The detection result that Bob obtains essentially reveals 
the phase differenee between two pulses i and i±d, where + stands for shifting forward and — 
stands for backward. The key rate of the RRDPS QKD protoeol is given by^ 


R = Q[1- i/(ebit) - Hpa] , (2) 

where R is the final key bit per L-pulse train. In experiment, the average number of valid 
detections per L-pulse train, Q, can be measured direetly. In Method, we show how to estimate 
the privacy amplification term Hp^. 

In this letter, we demonstrate the RRPDS QKD protoeol with L = 128. The setup is 
shown in Fig. 2. On sender side, a continuous-wave (CW) external cavity laser (ECL) is em¬ 
ployed as the optieal source. The central wavelength of the ECL is 1550.12?7,m with a linewidth 
below 2kHz, whieh can provide a coherence time beyond 500/is. This CW laser is modulated 
by an amplitude modulator (AM, Photline lOGHz) in order to produee a 128-pulse train. The 
pulses, with a full width at half maximum (EWHM) of 300ps, are separated by 2ns. Thus the 
overall duration of a pulse train (also a round) is about 256ns. A phase modulator (PM, Photline 
lOGHz) is employed to eneode a random phase shift, 0 or tt, on eaeh pulse. 
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On receiver side, an interferometer with variable delays is constructed in order to perform 
different interference measurements, as shown in Fig. 2. The required delay time is a discrete 
value in {2ns, 4ns, • • • , 254ns}. Seven delay gates, denoted as DGi for i G (1, • • • ,7} with a 
fixed delay fibre that can delay an optical pulse for a time of 2* x 2ns, are arranged to achieve 
the 128-value dynamic delays. The length of delay path is carefully adjusted to ensure that 
pulses with and without delay can overlap well. Meanwhile, the coupling efficiency of every 
pair of collimators is above 90% to ensure the intensity of pulses undergoing different numbers 
of delay gates as closely as possible. The seven delay gates are controlled by a 7-bit random 
number. By making use of these delay gates, we realize any dynamic discrete delay time from 
the set of {0ns, 2ns, 4ns • • • , 254ns}, which includes all the required values of our experiment. 

Each delay gate is constructed by a pockels cell, a fibre with fixed length and two polar¬ 
izing beam splitters (PBS) as input port and output port, as shown in Fig. 2. The pockels cell 
contains two RTP crystals. Each pockels cell is controlled by a customized high voltage pulse 
generator to achieve a fast switch between 0 V and half-wave voltage which is around 2100 V. 
For each one of delay gates, if the control bit is 0, the pockels cell will not affect the arrived 
pulses which will lead to pass through the output PBS and no delay happened. If the control 
bit is 1, the pockels cell will be driven by the half-wave voltage to convert the polarization state 
of arrived photons from horizontal (|i7)) to vertical (|%)). Thus the pulses will be reflected by 
the output PBS and propagate through the delay fibre. The delay gate of 2 ns (DGi) is ob¬ 
tained by a free-space optical link of ~ 0.6 m. The other delay gates of longer than 2 ns are 
obtained by the fibres with appropriate lengths. After reflected by the input PBS, the pulses 
pass through the half-wave voltage pockels cell again leading to convert the polarization back 
to \H) and pass through the output PBS. These seven delay gates are distributed in both arms of 
the interferometer to balance the transmittance. Some PBSs are shared between two neighbour 
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gates. 


After interfered at a fibre beam splitter (FBS), the pulses are deteeted by two eustom up- 
eonvert single photon deteetors^® (SPD). By interaeted with 1950nm pump laser in a PPLN 
waveguide, 1550 nm single photons are up-eonverted to 863 nm and then deteeted by eommer- 
eial Si-based single photon deteetors. The output of the SPDs are reeorded by a high-speed 
and high-aeeuraey time-to-digital eonverter (TDC). The overall deteetion effieieney of the up- 
eonvert deteetor is around 10%, and the dark eount is lower than 200eps. 

In this experiment, we have realized a dynamie interferometer with 128 delays on mea¬ 
surement site. All of these possible interferometers require stability in the sub-wavelength 
order to perform high visibility interferenee measurements. To suppress meehanieal vibration 
and temperature drift from the optieal table and air, we employ a frame with thermal insulation 
and the high-damping material to envelop the interferometer. With these passive phase stabil¬ 
isation methods, 128 kinds of unequal-arm interferometers ean maintain a visibility of higher 
than 96% for a time period in the order of ten seeonds, depending on the delay d. The residual 
phase instability is mainly due to the drift of the eentral wavelength of the laser. Therefore, 
to implement a eomplete RRDPS QKD experimental demonstration, an aetive phase-looking 
teohnique is required. On sender side, an additional path without modulation of AM and PM, 
whieh is named phase-loeking light with a relatively higher intensity of about 60 million pho¬ 
tons per seoond, is introduoed by an FBS and an optieal switoh. The phase-looking light is 
switehed on for 340 ms per seoond is used for phase-loeking to oalibrate the interferometers. 
The rest 660 ms per seoond is used for QKD. During phase-looking, the 128 delays are tra¬ 
versed by turning on the speoifie Poekels Cells. PM 2 is deployed to adjust the relative phase 
between two arms of the interferometers. For eaeh delay, the optimal eompensate voltage of 
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PM 2 is measured and reeorded by a eustom Field Programmable Gate Array (FPGA) in the 
eontrol board (see Methods). The reeorded eompensate voltages are used to maintain the rela¬ 
tive phase unehanged against different delay seleetions and eentral wavelength drift. With the 
aetive phase-loeking teehnique, the visibility of most interferometers ean be maintained over 
96% for hours simultaneously, as shown in Fig. 3a. 

In this letter, the experiment is demonstrated through a 1 km fibre link. The intensity of 
eaeh pulse is 0.00625 and the total intensity of the L-pulse train is 0.8. The repetition rate of 
pulse trains is 10 kHz. With 34% of time used for ealibration, 6600 pulse trains are transmitted 
per seeond. In the experiment, we obtain 675, 937 bits sifted keys in total. The bit flip error rates 

ir) 

with different random delays r, el-j., are shown in Fig. 3b. Due to the unbalance of the two arms 
of interferometer, there are fluetuation of the bit error rates with different delays. Interestingly, 
the bit error rate depends on the delay r and the overall error rate is 8.9%. The total number of 
the rounds sent is 103679400 and finally 2.441 x 10^ bits of seeurity key is generated in 15709 
seeonds. Therefore, the key generation rate is given by 15.54 bps. 

Reeently, another RRDPS QKD protoeol is proposed and experimentally demosntrated’k 
Differenee from the original RRDPS protocol, the random delay is chosen passively. A full 
scale comparison between two protocols is an interesting prospective project. 

Methods 

Privacy amplification estimation. Our postprocessing essentially follows the improved result^ 
as well as the original one^. The phase error rate of the RRDPS QKDprotocol is solely deter¬ 
mined by the source preparation. To be more specific, the leaked information Eve can obtained 
is upper-bound by the photon-number of the state Alice prepares in an L-pulse train^. In the 
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case that the photon-number in an L-pulse train is a eonstant, a tighter bound of the phase error 
rate ean be obtained by eonsidering more details of the souree^. 

_ 1 - (1 - 2 / 0 " ( 3 ) 

P" 2 ’ 

where n is the total number of photons in the L-pulse train. 


In the experiment, the weak eoherent souree is used as the souree whose photon-number 
follows a Poisson distribution. When eonsidering the worst ease, we assume that Bob only 
reeeives high-photon number states, whose photon number is bigger than rith, and losses always 
eome from all the low-photon number states, whose photon number is smaller than nth- Then 
QHph , the eost of privaey amplifieation per round, is given by 

QHpA<Q^,H(eX}+ Y. 

n=ntH + l 

n=nth+^ 

where and ean be upper-bounded aeeording to Eq. (3). And nth is the threshold photon 
number satisfy the total gain, Q, ean be determined by eontributions of the terms whose photon 
numbers are at least nth. 


Active phase stabilization. The output intensity of one port of a Maeh-Zehnder interfer¬ 
ometer ean be expressed as |(1 -fcos f-Pr), where / is the input power and is the relative phase 
between two paths for eaeh delay r. The aetive phase stabilization teehnique is aimed to mea¬ 
sure the value of pr at phase-loeking stage and eompensate it by using a PM at QKD stage. To 
realize the measurement, the PM is set to apply extra phases of where/c G 0,1, ...,A^ 

sequentially, eorresponding to output intensity of Jfc = |(1 -t- cos(pr + Pext))- For eaeh voltage, 
the eounting rate of two single photon deteetors, Cf and C 2 are reeorded by FPGA. To deter¬ 
mine pr, a least squares method is used to aehieve the minimal of S{pr) = ~ 
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N is chosen to be 4 in this experiment. Due to the imperfection, such as nonlinear of the 
voltage-phase mapping and fluctuations of photon number counting, the calculated compensate 
voltage of PM is usually not precise enough. The compensate voltage is then searched around 
the calculated value for a few steps to obtain a more suitable one. Finally, a lookup table is built 
to store the compensate voltages for each delay. 

Time sequence control. The setup of Alice’s side and Bob’s side are controlled by two 
independent FPGA based on integrated control boards, CBa and CBi,. The phase-locking light 
is switched on for 340ms as the phase-locking stage. During this stage. Bob traversals each 
value of r by switch on specific delay gates to measure the compensation phase ipr. After 
phase-locking, Alice switches photon source to pulse mode which is modulated by AM and 
PM. The AM is directly controlled by amplified RF signal output from Arbitrary Waveform 
Generators(AWG), which is synchronized by CBa, to generate pulses separated by 2ns with the 
FWHM of 300ps. Random numbers are generated by a QRNG module on CBa and transmitted 
to the AWG to compile as PM controlling waveform. The repetition rate of round is lOkHz 
in our experiment, thus phase encoded 128-pulse trains are produced per 100/is. The start of 
rounds for AWG and CB^ are triggered by CBa separately. At the beginning of per round, 7 bits 
of quantum random number generated by QRNG module on CB^ are consumed to determine 
the delay r. Specific delay gates are turned on to construct the time delay. And PM 2 is set to 
the related voltage stored in the look-up table. Due to the slow rising time of the pockels cells, it 
takes 90/is to wait before trigger Alice’s pulses to ensure the delay gates are precisely switched 
before. Finally, the trigger signal and the output of up-conversion detectors are recorded by a 
TDC on CBb. 
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Table 1: The experimental experimental parameters and results of our RRDPS experiment. 


Total rounds 

Sifted key 

Q 

(mean) 

L 

Final key length 

103,679,400 

675,937 

0.00652 

0.8 8.9% 

128 

2.441 X 10 ® 
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Figure 1: Schematic diagram of RRDPS QKD proposal. State preparation: Alice gener¬ 
ates an L-pulse train by modulating a narrow linewidth continuous-wave (CW) laser with an 
amplitude modulator (AM). Then random phase shift of 0 or vr is performed in each pulse. Af¬ 
ter attenuating the intensity of an L-pulse train to a preset u, the L-pulse train is transmitted 
to Bob through a fibre channel. Measurement: Bob generates two random numbers: c from 
{0,1}, which denotes the direction of the delay, and d from (1,2,...,L — 1}, which denotes the 
length of the delay. Then the arrived pulse train is split into two with a beamsplitter (BS) and 
a random delay of r' = {—l^d pulses is applied to one of the split trains. Then the two pulse 
trains are combined on a beam splitter, performed an interference measurement and obtained a 
index, Lof the pulse which is detected a photon together with the sifted key s* © S(j+r/ mod l)- 
Announcement: Bob announces i and {i + r mod L) so that Alice can calculate the sifted key 

Si © S(iJ^r' mod L)- 
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Figure 2: Experimental setup. ECL: external eavity laser; AM: amplitude modulator; PM: 
phase modulator; ATT: attenuator; (F) PBS: (fibre) polarizing beam splitter; FBS: fibre beam 
splitter; OS: optieal switeh; HWP: half-wave plate; PC: poekels eell; DG: delay gate; WDM: 
wavelength division multiplexing. The 7 delay gates are implemented by 6 fibre links with 
appropriate length and a free-spaee link. 7 poekels eells are deployed to eontrol the state of 
eaeh delay gate. The interference measurement is performed on FBS 2 and completed on two 
up-conversion detectors, whose details are shown in the middle of Bob’s setup. 
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Figure 3: a, The phase stability with aetive phase loeking over several hours. For most values 
of d, for example d = 15 and d = 100, the visibility is maintained above 96%. For eertain delay 
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such as a = 128, the relative phase becomes a little more unstable, b, over 128 logical 
delays. The mean error rate is 8.9%. In our experimental configuration of RRDPS QKD, the 


key rate keeps positive for each delay. 
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